From 2c6bff6f44037194f5f60bc701db92dc6173c9dd Mon Sep 17 00:00:00 2001
From: djm <djm@openbsd.org>
Date: Thu, 27 Jul 2023 22:26:49 +0000
Subject: [PATCH] don't incorrectly truncate logged strings retrieved from
 PKCS#11 modules; based on GHPR406 by Jakub Jelen; ok markus

---
 usr.bin/ssh/ssh-pkcs11.c | 39 +++++++++++++++++++--------------------
 1 file changed, 19 insertions(+), 20 deletions(-)

diff --git a/usr.bin/ssh/ssh-pkcs11.c b/usr.bin/ssh/ssh-pkcs11.c
index e9aada6b898..0576b1c1317 100644
--- a/usr.bin/ssh/ssh-pkcs11.c
+++ b/usr.bin/ssh/ssh-pkcs11.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-pkcs11.c,v 1.58 2023/07/19 14:02:27 djm Exp $ */
+/* $OpenBSD: ssh-pkcs11.c,v 1.59 2023/07/27 22:26:49 djm Exp $ */
 /*
  * Copyright (c) 2010 Markus Friedl.  All rights reserved.
  * Copyright (c) 2014 Pedro Martelletto. All rights reserved.
@@ -612,19 +612,22 @@ pkcs11_ecdsa_wrap(struct pkcs11_provider *provider, CK_ULONG slotidx,
 }
 
 /* remove trailing spaces */
-static void
+static char *
 rmspace(u_char *buf, size_t len)
 {
 	size_t i;
 
-	if (!len)
-		return;
-	for (i = len - 1;  i > 0; i--)
-		if (i == len - 1 || buf[i] == ' ')
+	if (len == 0)
+		return buf;
+	for (i = len - 1; i > 0; i--)
+		if (buf[i] == ' ')
 			buf[i] = '\0';
 		else
 			break;
+	return buf;
 }
+/* Used to printf fixed-width, space-padded, unterminated strings using %.*s */
+#define RMSPACE(s) (int)sizeof(s), rmspace(s, sizeof(s))
 
 /*
  * open a pkcs11 session and login if required.
@@ -1539,15 +1542,13 @@ pkcs11_register_provider(char *provider_id, char *pin,
 		    provider_id, rv);
 		goto fail;
 	}
-	rmspace(p->info.manufacturerID, sizeof(p->info.manufacturerID));
-	rmspace(p->info.libraryDescription, sizeof(p->info.libraryDescription));
-	debug("provider %s: manufacturerID <%s> cryptokiVersion %d.%d"
-	    " libraryDescription <%s> libraryVersion %d.%d",
+	debug("provider %s: manufacturerID <%.*s> cryptokiVersion %d.%d"
+	    " libraryDescription <%.*s> libraryVersion %d.%d",
 	    provider_id,
-	    p->info.manufacturerID,
+	    RMSPACE(p->info.manufacturerID),
 	    p->info.cryptokiVersion.major,
 	    p->info.cryptokiVersion.minor,
-	    p->info.libraryDescription,
+	    RMSPACE(p->info.libraryDescription),
 	    p->info.libraryVersion.major,
 	    p->info.libraryVersion.minor);
 	if ((rv = f->C_GetSlotList(CK_TRUE, NULL, &p->nslots)) != CKR_OK) {
@@ -1582,15 +1583,13 @@ pkcs11_register_provider(char *provider_id, char *pin,
 			    "provider %s slot %lu", provider_id, (u_long)i);
 			continue;
 		}
-		rmspace(token->label, sizeof(token->label));
-		rmspace(token->manufacturerID, sizeof(token->manufacturerID));
-		rmspace(token->model, sizeof(token->model));
-		rmspace(token->serialNumber, sizeof(token->serialNumber));
-		debug("provider %s slot %lu: label <%s> manufacturerID <%s> "
-		    "model <%s> serial <%s> flags 0x%lx",
+		debug("provider %s slot %lu: label <%.*s> "
+		    "manufacturerID <%.*s> model <%.*s> serial <%.*s> "
+		    "flags 0x%lx",
 		    provider_id, (unsigned long)i,
-		    token->label, token->manufacturerID, token->model,
-		    token->serialNumber, token->flags);
+		    RMSPACE(token->label), RMSPACE(token->manufacturerID),
+		    RMSPACE(token->model), RMSPACE(token->serialNumber),
+		    token->flags);
 		/*
 		 * open session, login with pin and retrieve public
 		 * keys (if keyp is provided)
-- 
2.20.1